Langflow Security Review: Critical RCE Vulnerabilities in 1.0.0–1.12.8

Langflow OSS contains multiple critical vulnerabilities that allow unauthenticated remote code execution and authentication bypass in all releases from 1.0.0 to 1.12.8. The issues affect users who run the open-source AI workflow builder with default settings. IBM issued a security bulletin confirming the flaws and naming version 1.13.0 as the required fix.

Langflow Vulnerabilities Details

CVE-2026-93680 carries a CVSS score of 9.8 and stems from improper authentication that grants a superuser session through the default auto-login feature. CVE-2026-110186 also scores 9.8 and permits unauthenticated code execution by abusing the Model Context Protocol tool enumeration and custom component handling. Two additional CVEs affect authenticated users: CVE-2026-110193 allows OS command execution with low privileges, while CVE-2026-110192 exposes stored credentials.

These flaws exist because auto-login remained enabled by default through version 1.12.8, released around October 22, 2026. The server-side Python execution model used for custom components and MCP integration created direct paths for remote attackers. No confirmed in-the-wild exploitation of these specific CVEs has been reported as of November 3, 2026, although a public Metasploit module demonstrates the authentication bypass portion.

Langflow has faced prior security issues. CVE-2025-3248 appeared in the CISA KEV catalog and was linked to ransomware activity, and CVE-2026-9198 was added in August 2026. The pattern of recurring remote code execution and authentication problems highlights ongoing risks for organizations that deploy the tool without strict network controls.

Upgrade Steps and Exposure Reduction

Users must upgrade every installation to Langflow 1.13.0. The command on PyPI is pip install --upgrade "langflow==1.13.0". Docker users should switch to the langflowai/langflow:1.13.0 image. Before upgrading, back up the database, secret key, and any custom files because the release disables auto-login and may require new account setup for password-based access.

Network exposure must be limited after the upgrade. Restrict access to port 7860 and any MCP endpoints so that only authorized systems can reach them. IBM states that no temporary workarounds or mitigations exist for the affected versions, making the version change the sole remediation path.

Organizations should also review logs for signs of prior compromise and rotate any credentials that may have been stored in Langflow. Monitoring for unusual process execution or outbound connections from Langflow instances provides an additional layer of detection while the upgrade is completed.

Background on Langflow and Prior Incidents

Langflow provides a visual interface for building AI agents and flows, with execution handled on the server side. The project moved under IBM and DataStax stewardship, yet the open-source releases continued to ship with auto-login enabled until the October 22, 2026 update. Release notes for 1.13.0 reference both the auto-login change and improved code scanning.

Security researchers at Ostorlab, Helix, and Rescana published detailed analyses of the new CVEs in late October 2026. The IBM bulletin dated October 28, with an update on October 29, lists the four vulnerabilities and confirms that only 1.13.0 resolves them. Public exploit code remains limited to the authentication bypass demonstration at this time.

Decision makers evaluating Langflow should verify the installed version before granting network access. The combination of unauthenticated RCE and the history of earlier exploited flaws makes prompt patching a priority for any production deployment.